Privacy Policy 

GDPR Compliance Statement

Opalite Learning, we are fully committed to protecting your personal data and ensuring compliance with the General Data Protection Regulation (GDPR). We collect and process personal data transparently, securely, and only for specific, necessary purposes.

We are registered with the Information Commissioner's Office (Registration No: ZB891150).

Your Consent

By signing and submitting our registration form, you explicitly consent to providing Opalite Learning with your email address and confirm your agreement that it will be shared with our CPD partner for certification purposes.

How We Use Your Data

• Account Creation & Communication: We use your email address to send you detailed instructions on how to log in to the Opalite Learning platform.

• Platform Access: We use your email address as your unique login credential to grant you secure access to the Opalite Learning platform.

• CPD Accreditation: To ensure you receive your official professional recognition, we share your email address with our Continuing Professional Development (CPD) accreditation partner. They will use this solely to email your CPD accreditation certificates directly to you.

Data Retention and Deletion

We practice strict data minimisation and do not hold onto your information longer than necessary. Your email address will be stored on our system for a duration of four months while you use the platform. After this period, or as soon as you no longer require access to the platform, your data will be permanently wiped from our systems.

Your Rights

Under the GDPR, you retain full rights over your data, including the right to withdraw your consent, or to access, rectify, and request the erasure of your email address at any time.

For any data privacy enquiries or to exercise your rights, please contact us directly at [Insert Contact Email / Link to Contact Form].

 

Internal Policy: Information Governance Policy

Document Reference: IG-POL-001
Effective Date: November 2026
Review Frequency: Annually

1. Purpose

This policy ensures all administrators, contractors, and staff at Opalite Learning handle student and staff email addresses securely, legally, and in strict accordance with data protection regulations (UK/EU GDPR).

2. Scope

This policy applies directly to all user email addresses collected via the Opalite Learning platform, covering both students and staff.

3. Data Collection & Purpose Limitation

• Lawful Basis: Personal data for all users is processed based on explicit consent collected at registration.

• Strict Purpose Restriction: Email addresses must only be used for the following operational steps:

  1. Sending automated or manual onboarding instructions explaining how to log in to the platform.

  2. Generating and authenticating secure user login credentials.

  3. Transferring to the designated CPD accreditation partner strictly after a user has completed their course, enabling certificate delivery.

• Prohibition: Staff are strictly prohibited from using these email addresses for marketing purposes or sharing them with any unauthorised third parties.

4. Data Security & Access Controls

• Access Control: Only authorised platform administrators who require the data to manage accounts, send login instructions, or process completions may access the user database.

• Storage: All email addresses must be securely encrypted and hosted on our approved, compliant cloud servers.

• Local Downloads: Staff must not download email lists to personal laptops, local drives, or unencrypted USB sticks. If a temporary download is required for administrative tasks or CPD reporting, the file must be permanently deleted immediately after the task is finished.

5. Third-Party Transfers (CPD Company)

• Trigger-Based Sharing: User emails must only be shared with the CPD partner once the course completion criteria have been met.

• Secure Transfer: Data transfers to the CPD partner must be handled via secure, encrypted channels (such as a secure API link or password-protected file delivery).

• Data Processing Agreements: A signed Data Processing Agreement (DPA) must remain active with the CPD partner to ensure they delete or safeguard the emails after sending out the certificates.

6. Strict Data Retention & Destruction (The Four-Month Rule)

• Retention Window: All student and staff email records must be removed from the active system exactly four months after account creation, or immediately if the user no longer requires access.

• Secure Deletion: Admin staff must ensure that data is completely purged from the live platform database and any associated server backups. "Soft deletion" (simply hiding or archiving the record) does not comply with this policy.

7. Data Breach Response

Any suspected or confirmed data loss (such as a compromised admin login, a leaked email list, or an unencrypted file send) must be reported to the platform owner within 24 hours to meet strict regulatory notification timelines.